Before logging in to the asp.net application, i checked the headers and there was already a session id in cookie header cookie: ASP.NET_SessionId=3de0es3brpfbcmvkzhkidsmt

And when i logged in to the application, the same cookie header was present there. When i send a request by removing this cookie header from the request, i am logged out. So my question is what is happening over there? Is it some bug? Please elaborate. Thanks


Not a bug, the Session Cookie is created regardless of 'user' authentication. The sessID cookie is ONLY an Identifier (X Client has X Cookie). Once a user has been authenticated with the server you may continue to use that cookie to identify the authenticated user.

  • so what if someone else captures that cookie? he will be impersonating me? – Usama Saeed Jul 24 '16 at 10:35
  • 1
    Yes if someone gets a sessID cookie they can impersonate you, which is why you need to develop risk mitigating strategies. Using HTTPS can help prevent MITM attacks from reading the Cookie in plaintext. XSS prevention should limit code injection to steal the cookie etc. – Scrapps Jul 24 '16 at 10:43
  • 1
    What you are describing is known to lead to session fixation vulnerabilities. owasp.org/index.php/Session_fixation – Neil Smithline Jul 24 '16 at 17:33
  • @NeilSmithline bang on target. I wish you had elaborated more and I would have upvoted it as an answer. – GhostSpeaks101 Jul 25 '16 at 11:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.